Example usage for org.bouncycastle.asn1.x509 Extension getParsedValue

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 Extension getParsedValue.

Prototype

public ASN1Encodable getParsedValue() 

Source Link

Usage

From source file:org.cryptable.pki.communication.PKICMPMessages.java

License:Open Source License

/**
 * Update a certification request with local key generation
 *
 * @param certificate to be updated//from w ww  .j  av  a  2s.  com
 * @return return the binary ASN.1 message for a certification request
 * @throws CertificateEncodingException
 * @throws CMSException
 * @throws CRMFException
 * @throws OperatorCreationException
 * @throws CMPException
 * @throws IOException
 */
public byte[] createKeyUpdateMessageWithLocalKey(X509Certificate certificate, KeyPair keyPair)
        throws CertificateEncodingException, CMSException, CRMFException, OperatorCreationException,
        CMPException, IOException, PKICMPMessageException, NoSuchFieldException, IllegalAccessException {
    JcaCertificateRequestMessageBuilder certReqBuild = new JcaCertificateRequestMessageBuilder(BigInteger.ZERO);
    X509CertificateHolder x509CertificateHolder = new JcaX509CertificateHolder(certificate);

    certReqBuild.setSubject(x509CertificateHolder.getSubject());
    certReqBuild.setIssuer(x509CertificateHolder.getIssuer());
    certReqBuild.setSerialNumber(x509CertificateHolder.getSerialNumber());
    if (keyPair != null) {
        certReqBuild.setPublicKey(keyPair.getPublic());
        if (keyPair.getPrivate() != null) {
            certReqBuild.addControl(
                    new JcaPKIArchiveControlBuilder(keyPair.getPrivate(), x509CertificateHolder.getIssuer())
                            .addRecipientGenerator(
                                    new JceKeyTransRecipientInfoGenerator(pkiKeyStore.getRecipientCertificate())
                                            .setProvider(pkiKeyStore.getProvider()))
                            .build(new JceCMSContentEncryptorBuilder(
                                    new ASN1ObjectIdentifier(CMSEnvelopedDataGenerator.DES_EDE3_CBC))
                                            .setProvider(pkiKeyStore.getProvider()).build()));

        }
    } else
        certReqBuild.setPublicKey(x509CertificateHolder.getSubjectPublicKeyInfo());

    if (extensions != null) {
        for (Extension extension : extensions)
            certReqBuild.addExtension(extension.getExtnId(), extension.isCritical(),
                    extension.getParsedValue());
    } else {
        if (x509CertificateHolder.getExtensions() != null) {
            for (ASN1ObjectIdentifier oid : x509CertificateHolder.getExtensions().getExtensionOIDs()) {
                certReqBuild.addExtension(oid,
                        x509CertificateHolder.getExtensions().getExtension(oid).isCritical(),
                        x509CertificateHolder.getExtensions().getExtensionParsedValue(oid));
            }
        }
    }

    OptionalValidity tempOptionalValidity;
    if (optionalValidity != null) {
        tempOptionalValidity = optionalValidity;
    } else {
        tempOptionalValidity = new OptionalValidity(new Time(x509CertificateHolder.getNotBefore()),
                new Time(x509CertificateHolder.getNotAfter()));
    }
    Field field = certReqBuild.getClass().getSuperclass().getDeclaredField("templateBuilder");
    field.setAccessible(true);
    CertTemplateBuilder certTemplateBuilder = (CertTemplateBuilder) field.get(certReqBuild);
    certTemplateBuilder.setValidity(tempOptionalValidity);

    CertReqMessages certReqMsgs = new CertReqMessages(certReqBuild.build().toASN1Structure());

    return createProtectedPKIMessage(new PKIBody(PKIBody.TYPE_KEY_UPDATE_REQ, certReqMsgs));
}

---

From source file:org.cryptable.pki.communication.PKICMPMessages.java

License:Open Source License

/**
 * Update a certification request with remote key generation
 *
 * @param certificate to be updated//from   w  ww. j  a  va 2 s . c  o  m
 * @return return the binary ASN.1 message for a certification request
 * @throws CertificateEncodingException
 * @throws CMSException
 * @throws CRMFException
 * @throws OperatorCreationException
 * @throws CMPException
 * @throws IOException
 */
public byte[] createKeyUpdateMessageWithRemoteKey(X509Certificate certificate)
        throws CertificateEncodingException, CMSException, CRMFException, OperatorCreationException,
        CMPException, IOException, PKICMPMessageException, NoSuchFieldException, IllegalAccessException {
    JcaCertificateRequestMessageBuilder certReqBuild = new JcaCertificateRequestMessageBuilder(BigInteger.ZERO);
    X509CertificateHolder x509CertificateHolder = new JcaX509CertificateHolder(certificate);

    certReqBuild.setSubject(x509CertificateHolder.getSubject());
    certReqBuild.setIssuer(x509CertificateHolder.getIssuer());
    certReqBuild.setSerialNumber(x509CertificateHolder.getSerialNumber());

    if (extensions != null) {
        for (Extension extension : extensions)
            certReqBuild.addExtension(extension.getExtnId(), extension.isCritical(),
                    extension.getParsedValue());
    } else {
        if (x509CertificateHolder.getExtensions() != null) {
            for (ASN1ObjectIdentifier oid : x509CertificateHolder.getExtensions().getExtensionOIDs()) {
                certReqBuild.addExtension(oid,
                        x509CertificateHolder.getExtensions().getExtension(oid).isCritical(),
                        x509CertificateHolder.getExtensions().getExtensionParsedValue(oid));
            }
        }
    }

    OptionalValidity tempOptionalValidity;
    if (optionalValidity != null) {
        tempOptionalValidity = optionalValidity;
    } else {
        tempOptionalValidity = new OptionalValidity(new Time(x509CertificateHolder.getNotBefore()),
                new Time(x509CertificateHolder.getNotAfter()));
    }
    Field field = certReqBuild.getClass().getSuperclass().getDeclaredField("templateBuilder");
    field.setAccessible(true);
    CertTemplateBuilder certTemplateBuilder = (CertTemplateBuilder) field.get(certReqBuild);
    certTemplateBuilder.setValidity(tempOptionalValidity);

    CertReqMessages certReqMsgs = new CertReqMessages(certReqBuild.build().toASN1Structure());

    return createProtectedPKIMessage(new PKIBody(PKIBody.TYPE_KEY_UPDATE_REQ, certReqMsgs));
}

---

From source file:org.ejbca.core.protocol.ocsp.extension.certhash.OcspCertHashExtensionTest.java

License:Open Source License

/**
 * This test runs a vanilla run through of the process method of OcspCertHashExtension, and simply verifies that 
 * the certHash is correctly produced (i.e fingerprint by SHA256)
 * @throws CertificateException /*  w  w w . j  a v  a  2s.  c om*/
 * @throws OperatorCreationException 
 * 
 */
@Test
public void testProcess() throws InvalidKeyException, NoSuchAlgorithmException, SignatureException,
        IllegalStateException, NoSuchProviderException, InvalidAlgorithmParameterException, IOException,
        OperatorCreationException, CertificateException {
    OcspCertHashExtension ocspCertHashExtension = new OcspCertHashExtension();
    KeyPair keys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
    X509Certificate cert = CertTools.genSelfCert("CN=CertHashTest", 365, null, keys.getPrivate(),
            keys.getPublic(), AlgorithmConstants.SIGALG_SHA1_WITH_RSA, false);
    Map<ASN1ObjectIdentifier, Extension> result = ocspCertHashExtension.process(null, null, null, cert, null);
    Extension extension = result.get(new ASN1ObjectIdentifier(OcspCertHashExtension.CERT_HASH_OID));
    ASN1Encodable derSequence = extension.getParsedValue();
    CertHash certHash = CertHash.getInstance(derSequence);
    assertEquals("Algorithm was not extracted correctly from CertHash", OcspCertHashExtension.SHA256,
            certHash.getHashAlgorithm().getAlgorithm());
    MessageDigest md = MessageDigest.getInstance("SHA256");
    String fingerprint = new String(Hex.encode(md.digest(cert.getEncoded())));
    String certificateHashAsString = new String(Hex.encode(certHash.getCertificateHash()));
    assertEquals("Fingerprint (certificate hash) was not extracted correctly", fingerprint,
            certificateHashAsString);
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolOcspHttpTest.java

License:Open Source License

/**
 * This test tests that the OCSP response contains the extension "id-pkix-ocsp-extended-revoke" in case the 
 * status of an unknown cert is returned as revoked.
 * //from w w w  . jav  a 2 s  . com
 * @throws Exception
 */
@Test
public void testExtendedRevokedExtension() throws Exception {

    OCSPReqBuilder gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert, new BigInteger("1")));
    OCSPReq req = gen.build();
    BasicOCSPResp response = helper.sendOCSPGet(req.getEncoded(), null, OCSPRespBuilder.SUCCESSFUL, 200);
    assertNotNull("Could not retrieve response, test could not continue.", response);
    assertTrue(response.getResponses()[0].getCertStatus() instanceof UnknownStatus);
    // RFC 6960: id-pkix-ocsp-extended-revoke OBJECT IDENTIFIER ::= {id-pkix-ocsp 9}
    Extension responseExtension = response
            .getExtension(new ASN1ObjectIdentifier(OCSPObjectIdentifiers.id_pkix_ocsp + ".9"));
    assertNull("Wrong extension sent with reply", responseExtension);

    final Map<String, String> map = new HashMap<String, String>();
    map.put(OcspConfiguration.NONE_EXISTING_IS_REVOKED, "true");
    this.helper.alterConfig(map);

    gen = new OCSPReqBuilder();
    gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert, new BigInteger("1")));
    req = gen.build();
    response = helper.sendOCSPGet(req.getEncoded(), null, OCSPRespBuilder.SUCCESSFUL, 200);
    assertNotNull("Could not retrieve response, test could not continue.", response);
    assertTrue(response.getResponses()[0].getCertStatus() instanceof RevokedStatus);
    responseExtension = response
            .getExtension(new ASN1ObjectIdentifier(OCSPObjectIdentifiers.id_pkix_ocsp + ".9"));
    assertNotNull("No extension sent with reply", responseExtension);
    assertEquals(DERNull.INSTANCE, responseExtension.getParsedValue());
}

---

From source file:org.ejbca.core.protocol.ocsp.ProtocolOcspHttpTest.java

License:Open Source License

/**
 * This test tests that the OCSP response contains the extension "id_pkix_ocsp_archive_cutoff" if "ocsp.expiredcert.retentionperiod" 
 * is set in the condfiguration file//www.  j  a v  a  2 s. c  o  m
 * 
 * @throws Exception
 */
@Test
public void testExpiredCertArchiveCutoffExtension() throws Exception {

    final String username = "expiredCertUsername";
    String cpname = "ValidityCertProfile";
    String eepname = "ValidityEEProfile";
    X509Certificate xcert = null;

    CertificateProfileSessionRemote certProfSession = EjbRemoteHelper.INSTANCE
            .getRemoteSession(CertificateProfileSessionRemote.class);
    EndEntityProfileSessionRemote eeProfSession = EjbRemoteHelper.INSTANCE
            .getRemoteSession(EndEntityProfileSessionRemote.class);

    try {
        if (certProfSession.getCertificateProfile(cpname) == null) {
            final CertificateProfile cp = new CertificateProfile(
                    CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER);
            cp.setAllowValidityOverride(true);
            try {
                certProfSession.addCertificateProfile(admin, cpname, cp);
            } catch (CertificateProfileExistsException e) {
                log.error("Certificate profile exists: ", e);
            }
        }
        final int cpId = certProfSession.getCertificateProfileId(cpname);
        if (eeProfSession.getEndEntityProfile(eepname) == null) {
            final EndEntityProfile eep = new EndEntityProfile(true);
            eep.setValue(EndEntityProfile.AVAILCERTPROFILES, 0, "" + cpId);
            try {
                eeProfSession.addEndEntityProfile(admin, eepname, eep);
            } catch (EndEntityProfileExistsException e) {
                log.error("Could not create end entity profile.", e);
            }
        }
        final int eepId = eeProfSession.getEndEntityProfileId(eepname);

        if (!endEntityManagementSession.existsUser(username)) {
            endEntityManagementSession.addUser(admin, username, "foo123", "CN=expiredCertUsername", null,
                    "ocsptest@anatom.se", false, eepId, cpId, EndEntityTypes.ENDUSER.toEndEntityType(),
                    SecConst.TOKEN_SOFT_PEM, 0, caid);
            log.debug("created user: expiredCertUsername, foo123, CN=expiredCertUsername");
        } else {
            log.debug("User expiredCertUsername already exists.");
            EndEntityInformation userData = new EndEntityInformation(username, "CN=expiredCertUsername", caid,
                    null, "ocsptest@anatom.se", EndEntityConstants.STATUS_NEW,
                    EndEntityTypes.ENDUSER.toEndEntityType(), eepId, cpId, null, null, SecConst.TOKEN_SOFT_PEM,
                    0, null);
            userData.setPassword("foo123");
            endEntityManagementSession.changeUser(admin, userData, false);
            log.debug("Reset status to NEW");
        }

        // Generate certificate for the new user
        KeyPair keys = KeyTools.genKeys("512", "RSA");
        long now = (new Date()).getTime();
        long notAfter = now + 1000;
        xcert = (X509Certificate) signSession.createCertificate(admin, username, "foo123",
                new PublicKeyWrapper(keys.getPublic()), -1, new Date(), new Date(notAfter));
        assertNotNull("Failed to create new certificate", xcert);

        Thread.sleep(2000L); // wait for the certificate to expire

        // -------- Testing with default config value

        OCSPReqBuilder gen = new OCSPReqBuilder();
        gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
                xcert.getSerialNumber()));
        OCSPReq req = gen.build();
        BasicOCSPResp response = helper.sendOCSPGet(req.getEncoded(), null, OCSPRespBuilder.SUCCESSFUL, 200);
        assertNotNull("Could not retrieve response, test could not continue.", response);
        SingleResp resp = response.getResponses()[0];
        Extension singleExtension = resp.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_archive_cutoff);
        assertNotNull("No extension sent with reply", singleExtension);

        ASN1GeneralizedTime extvalue = ASN1GeneralizedTime.getInstance(singleExtension.getParsedValue());
        long expectedValue = (new Date()).getTime() - (31536000L * 1000);
        long actualValue = extvalue.getDate().getTime();
        long diff = expectedValue - actualValue;
        assertTrue("Wrong archive cutoff value.", diff < 60000);

        // -------- Send a request where id_pkix_ocsp_archive_cutoff SHOULD NOT be used
        // set ocsp configuration
        Map<String, String> map = new HashMap<String, String>();
        map.put(OcspConfiguration.EXPIREDCERT_RETENTIONPERIOD, "-1");
        this.helper.alterConfig(map);

        gen = new OCSPReqBuilder();
        gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
                xcert.getSerialNumber()));
        req = gen.build();
        response = helper.sendOCSPGet(req.getEncoded(), null, OCSPRespBuilder.SUCCESSFUL, 200);
        assertNotNull("Could not retrieve response, test could not continue.", response);
        resp = response.getResponses()[0];
        singleExtension = resp.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_archive_cutoff);
        assertNull("The wrong extension was sent with reply", singleExtension);

        // ------------ Send a request where id_pkix_ocsp_archive_cutoff SHOULD be used
        // set ocsp configuration
        map = new HashMap<String, String>();
        map.put(OcspConfiguration.EXPIREDCERT_RETENTIONPERIOD, "63072000"); // 2 years
        this.helper.alterConfig(map);

        gen = new OCSPReqBuilder();
        gen.addRequest(new JcaCertificateID(SHA1DigestCalculator.buildSha1Instance(), cacert,
                xcert.getSerialNumber()));
        req = gen.build();
        response = helper.sendOCSPGet(req.getEncoded(), null, OCSPRespBuilder.SUCCESSFUL, 200);
        assertNotNull("Could not retrieve response, test could not continue.", response);
        resp = response.getResponses()[0];
        singleExtension = resp.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_archive_cutoff);
        assertNotNull("No extension sent with reply", singleExtension);

        extvalue = ASN1GeneralizedTime.getInstance(singleExtension.getParsedValue());
        expectedValue = (new Date()).getTime() - (63072000L * 1000);
        actualValue = extvalue.getDate().getTime();
        diff = expectedValue - actualValue;
        assertTrue("Wrong archive cutoff value.", diff < 60000);

    } finally {
        endEntityManagementSession.revokeAndDeleteUser(admin, username, CRLReason.unspecified);
        eeProfSession.removeEndEntityProfile(admin, eepname);
        certProfSession.removeCertificateProfile(admin, cpname);
    }
}

---

From source file:org.jruby.ext.openssl.OCSPSingleResponse.java

License:Common Public License

@JRubyMethod(name = "extensions")
public IRubyObject extensions() {
    Ruby runtime = getRuntime();/* w ww. j a  v  a 2s  .c  o m*/
    Extensions exts = bcSingleResponse.getSingleExtensions();
    if (exts == null)
        return RubyArray.newEmptyArray(runtime);
    ASN1ObjectIdentifier[] extOIDs = exts.getExtensionOIDs();
    RubyArray retExts = runtime.newArray(extOIDs.length);
    for (ASN1ObjectIdentifier extOID : extOIDs) {
        Extension ext = exts.getExtension(extOID);
        ASN1Encodable extAsn1 = ext.getParsedValue();
        X509Extension retExt = X509Extension.newExtension(runtime, extOID, extAsn1, ext.isCritical());
        retExts.append(retExt);
    }
    return retExts;
}

---

From source file:org.jruby.ext.openssl.X509Extension.java

License:LGPL

static X509Extension newExtension(final Ruby runtime, ASN1ObjectIdentifier objectId,
        final Extension extension) {
    X509Extension ext = new X509Extension(runtime, _Extension(runtime));
    ext.setRealObjectID(objectId);/*from  w w  w .j a va  2  s.c o m*/
    ext.setRealValue(extension.getParsedValue());
    ext.setRealCritical(extension.isCritical());
    return ext;
}

---

From source file:org.signserver.module.renewal.worker.RenewalWorker.java

License:Open Source License

private static X509CertificateHolder getEndEntityCertificate(
        final Collection<? extends X509CertificateHolder> certs) {
    X509CertificateHolder result = null;
    for (X509CertificateHolder cert : certs) {
        Extension extension = cert.getExtension(X509Extension.basicConstraints);
        if (extension == null) {
            result = cert;/*from  w  w w .  j a  va  2s .  c  o  m*/
            break;
        } else {
            BasicConstraints bc = BasicConstraints.getInstance(extension.getParsedValue());
            if (!bc.isCA()) {
                result = cert;
                break;
            }
        }
    }
    return result;
}

---

From source file:org.tdmx.client.crypto.certificate.PKIXCertificate.java

License:Open Source License

private X500Name getSubjectNameConstraint() {
    Extension e = holder.getExtension(Extension.nameConstraints);
    if (e != null && e.isCritical()) {
        NameConstraints nc = NameConstraints.getInstance(e.getParsedValue());
        GeneralSubtree[] permitted = nc.getPermittedSubtrees();
        if (permitted != null && permitted.length > 0) {
            GeneralName base = permitted[0].getBase();
            if (base != null) {
                if (GeneralName.directoryName == base.getTagNo()) {
                    X500Name baseName = X500Name.getInstance(base.getName());
                    return baseName;
                }/* w  w  w  .j a  v  a2  s.c o m*/
            }
        }
    }
    return null;
}

---

From source file:org.tdmx.client.crypto.certificate.PKIXCertificate.java

License:Open Source License

private KeyUsage getKeyUsage() {
    Extension e = holder.getExtension(Extension.keyUsage);
    if (e != null) {
        KeyUsage ku = KeyUsage.getInstance(e.getParsedValue());
        return ku;
    }/*from   w w  w. j  a v  a  2 s  .c o  m*/
    return null;
}

---

• «
• 1
• 2
• 3
• 4
• 5
• »